Shell Metacharacter Injection in Tool Arguments - ATR-2026-00111 (51876ab5-65e2-591e-810d-a71d2c7ec204)
Detects shell metacharacter injection patterns in tool arguments or agent-generated commands. Attackers embed backtick execution, $() subshells, semicolons, pipes, or logical operators to chain malicious commands onto otherwise safe tool invocations. Null byte and newline injection are also covered as they can truncate or split commands in vulnerable parsers.